dependency security

.c8rc.json

@@ -0,0 +1,12 @@
+{
+  "all": true,
+  "src": ["src"],
+  "include": ["src/**/*.ts"],
+  "exclude": ["**/*.d.ts"],
+  "reporter": ["lcov", "text"],
+  "check-coverage": true,
+  "lines": 90,
+  "statements": 90,
+  "functions": 90,
+  "branches": 85
+}

.github/workflows/e2e-smoke.yml

@@ -0,0 +1,56 @@
+name: e2e-smoke
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  smoke:
+    name: smoke (${{ matrix.os }}, node ${{ matrix.node }}, sdk ${{ matrix.sdk }})
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+        node: ['lts/*']
+        # Oldest supported SDK release, and whatever is newest on PyPI.
+        sdk: ['7.0.0', 'latest']
+        include:
+          # Minimum Node version from package.json `engines`.
+          - os: ubuntu-latest
+            node: '22.19.0'
+            sdk: '7.0.0'
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node }}
+          cache: yarn
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Install Python SDK
+        shell: bash
+        env:
+          SDK_VERSION: ${{ matrix.sdk }}
+        run: |
+          if [ "$SDK_VERSION" = "latest" ]; then
+            python -m pip install --upgrade salesforce-data-customcode
+          else
+            python -m pip install "salesforce-data-customcode==$SDK_VERSION"
+          fi
+          # `scan` shells out to pipreqs, which the SDK does not install.
+          python -m pip install pipreqs
+          python -m pip show salesforce-data-customcode
+
+      - run: yarn install --frozen-lockfile
+
+      - run: yarn test:e2e

.github/workflows/test.yml

@@ -2,6 +2,8 @@ name: tests
 on:
   push:
     branches-ignore: [main]
+  # Fork PRs never trigger `push` in this repo, so also run on pull requests.
+  pull_request:
   workflow_dispatch:
 
 jobs:

.sfdevrc.json

@@ -5,6 +5,14 @@
   "wireit": {
     "test": {
       "dependencies": ["test:compile", "test:only", "lint"]
+    },
+    "test:only": {
+      "command": "c8 mocha \"test/**/*.test.ts\"",
+      "env": {
+        "FORCE_COLOR": "2"
+      },
+      "files": ["test/**/*.ts", "src/**/*.ts", "**/tsconfig.json", ".mocha*", "!*.nut.ts", ".c8rc.json"],
+      "output": []
     }
   }
 }

eslint.config.mjs

@@ -0,0 +1,6 @@
+import tsconfigs from 'eslint-config-salesforce-typescript';
+import plugin from 'eslint-plugin-sf-plugin';
+
+const configs = [...tsconfigs, ...plugin.configs.recommended];
+
+export default configs;

package.json

@@ -12,14 +12,21 @@
   "devDependencies": {
     "@oclif/plugin-command-snapshot": "^5.2.3",
     "@salesforce/cli-plugins-testkit": "^5.3.20",
-    "@salesforce/dev-scripts": "^11.0.4",
-    "eslint-plugin-sf-plugin": "^1.18.8",
+    "@salesforce/dev-scripts": "^15.0.0",
+    "@types/chai": "^4.3.17",
+    "@types/mocha": "^10.0.10",
+    "@types/node": "^22",
+    "@types/sinon": "^10.0.20",
+    "c8": "^10",
+    "eslint": "^10.13.0",
+    "eslint-config-salesforce-typescript": "^7.0.0",
+    "eslint-plugin-sf-plugin": "^3.0.4",
     "oclif": "^4.14.0",
     "ts-node": "^10.9.2",
-    "typescript": "^5.5.4"
+    "typescript": "^6.0.0"
   },
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=22.19.0"
   },
   "repository": "salesforcecli/plugin-data-code-extension",
   "files": [
@@ -80,6 +87,7 @@
     "prepack": "sf-prepack",
     "prepare": "sf-install",
     "test": "wireit",
+    "test:e2e": "yarn compile && mocha \"test/e2e/**/*.e2e.ts\"",
     "test:nuts": "nyc mocha \"**/*.nut.ts\" --slow 4500 --timeout 600000 --parallel",
     "test:only": "wireit",
     "version": "oclif readme"
@@ -124,6 +132,7 @@
         "src/**/*.ts",
         "test/**/*.ts",
         "messages/**",
+        "**/eslint.config.*",
         "**/.eslint*",
         "**/tsconfig.json"
       ],
@@ -145,7 +154,7 @@
       ]
     },
     "test:only": {
-      "command": "nyc mocha \"test/**/*.test.ts\"",
+      "command": "c8 mocha \"test/**/*.test.ts\"",
       "env": {
         "FORCE_COLOR": "2"
       },
@@ -155,7 +164,7 @@
         "**/tsconfig.json",
         ".mocha*",
         "!*.nut.ts",
-        ".nycrc"
+        ".c8rc.json"
       ],
       "output": []
     },
@@ -201,5 +210,9 @@
   "exports": "./lib/index.js",
   "type": "module",
   "author": "cdp-byoc@salesforce.com",
-  "packageManager": "yarn@1.22.22"
+  "packageManager": "yarn@1.22.22",
+  "resolutions": {
+    "serialize-javascript": "^7.0.5",
+    "uuid": "^11.1.1"
+  }
 }

src/base/deployBase.ts

@@ -40,7 +40,6 @@ export type DeployResult = SharedResultProps & {
   endpointUrl?: string;
 };
 
-// eslint-disable-next-line sf-plugin/command-summary, sf-plugin/command-example
 export abstract class DeployBase<TFlags extends BaseDeployFlags = BaseDeployFlags> extends SfCommand<DeployResult> {
   public static enableJsonFlag = false;
 

src/base/initBase.ts

@@ -27,7 +27,6 @@ export type InitResult = SharedResultProps & {
   executionResult?: NativeInitResult;
 };
 
-// eslint-disable-next-line sf-plugin/command-summary, sf-plugin/command-example
 export abstract class InitBase<TFlags extends BaseInitFlags = BaseInitFlags> extends SfCommand<InitResult> {
   public static enableJsonFlag = false;
 

src/base/lineageBase.ts

@@ -68,7 +68,6 @@ const PROJECT_CONFIG_YAML = 'config.yaml';
 /** Base-directory files `deploy` packages alongside payload/ (see zipBuilder). */
 const PACKAGED_BUILD_FILES = ['requirements.txt', 'build_native_dependencies.sh', 'Dockerfile.dependencies'];
 
-// eslint-disable-next-line sf-plugin/command-summary, sf-plugin/command-example
 export abstract class LineageBase extends SfCommand<LineageGenerateResult> {
   public static enableJsonFlag = true;
 
@@ -358,8 +357,7 @@ async function isPackageInput(file: string, dirs: string[], files: string[]): Pr
     realDirs.some((dir) => within(target, dir)) ||
     files.some((input) => sameFile(input, file)) ||
     realFiles.some((input) => sameFile(input, target)) ||
-    (targetStat !== undefined &&
-      fileStats.some((stat) => stat !== undefined && stat.dev === targetStat.dev && stat.ino === targetStat.ino))
+    (targetStat !== undefined && fileStats.some((stat) => stat?.dev === targetStat.dev && stat.ino === targetStat.ino))
   );
 }
 

src/base/runBase.ts

@@ -33,7 +33,6 @@ export type RunResult = SharedResultProps & {
   output?: string;
 };
 
-// eslint-disable-next-line sf-plugin/command-summary, sf-plugin/command-example
 export abstract class RunBase extends SfCommand<RunResult> {
   public static enableJsonFlag = false;
 

src/base/scanBase.ts

@@ -41,7 +41,6 @@ export type ScanResult = {
   executionResult: NativeScanResult;
 } & EnvironmentCheckResult;
 
-// eslint-disable-next-line sf-plugin/command-summary, sf-plugin/command-example
 export abstract class ScanBase extends SfCommand<ScanResult> {
   public static enableJsonFlag = false;
 

src/base/zipBase.ts

@@ -44,7 +44,6 @@ function formatBytes(bytes: number): string {
   return `${value.toFixed(unit === 0 ? 0 : 2)} ${units[unit]}`;
 }
 
-// eslint-disable-next-line sf-plugin/command-summary, sf-plugin/command-example
 export abstract class ZipBase extends SfCommand<ZipResult> {
   public static enableJsonFlag = false;
 

src/utils/pythonChecker.ts

@@ -103,7 +103,7 @@ export class PythonChecker {
         patch: parseInt(patch, 10),
       };
     } catch (error) {
-      throw new Error(`Python command '${command}' not found or not accessible`);
+      throw new Error(`Python command '${command}' not found or not accessible`, { cause: error });
     }
   }
 

test/commands/data-code-extension/deploy.test.ts

@@ -339,7 +339,7 @@ describe('data-code-extension deploy', () => {
       } catch (error: unknown) {
         expect(error).to.be.instanceOf(Error);
         // The framework may wrap the thrown SfError as a cause on the command error.
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-assignment, @typescript-eslint/no-unsafe-member-access
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-member-access
         const cause = (error as any).cause;
         if (cause) {
           expect(cause).to.be.instanceOf(SfError);

test/commands/data-code-extension/lineage.test.ts

@@ -63,7 +63,7 @@ describe('data-code-extension script lineage generate', () => {
   }
 
   function warnings(): string[] {
-    return sfCommandStubs.warn.getCalls().map((call) => String(call.args[0]));
+    return sfCommandStubs.warn.getCalls().map((call) => call.args[0] as string);
   }
 
   beforeEach(() => {
@@ -201,7 +201,7 @@ describe('data-code-extension script lineage generate', () => {
     await LineageGenerate.run([...baseArgs(), '--dry-run']);
     const logged = sfCommandStubs.log
       .getCalls()
-      .map((call) => String(call.args[0]))
+      .map((call) => call.args[0] as string)
       .join('\n');
     expect(logged).to.match(/drops:\r?\n {2}- out__dll\.old/);
     expect(logged).to.match(/changes:\r?\n {2}- out__dll\.id__c/);
@@ -313,7 +313,7 @@ describe('data-code-extension script lineage generate', () => {
     (Org.create as sinon.SinonStub).resolves({
       getUsername: () => undefined,
       getConnection: () => mockConnection,
-    } as unknown as Org);
+    });
     try {
       await LineageGenerate.run(baseArgs());
       expect.fail('Should have thrown');

test/commands/data-code-extension/run.test.ts

@@ -180,7 +180,7 @@ describe('data-code-extension run', () => {
       } catch (error: unknown) {
         expect(error).to.be.instanceOf(Error);
         // The framework may wrap the thrown SfError as a cause on the command error.
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-assignment, @typescript-eslint/no-unsafe-member-access
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-member-access
         const cause = (error as any).cause;
         if (cause) {
           expect(cause).to.be.instanceOf(SfError);

test/commands/data-code-extension/scan.test.ts

@@ -271,7 +271,7 @@ describe('data-code-extension scan commands', () => {
     const configFile = (): string => path.join(testDir, 'payload', 'config.json');
     const readConfig = (): Record<string, unknown> =>
       JSON.parse(fs.readFileSync(configFile(), 'utf8')) as Record<string, unknown>;
-    const warnings = (): string[] => sfCommandStubs.warn.getCalls().map((call) => String(call.args[0]));
+    const warnings = (): string[] => sfCommandStubs.warn.getCalls().map((call) => call.args[0] as string);
 
     beforeEach(() => {
       confirmStub = $$.SANDBOX.stub(SfCommand.prototype, 'confirm').resolves(true);